Hysolate has developed a baked-in higher privileged VM to access Azure in a locked down manner, while a second VM allows for less restrictive use. For networking, they’ve added what they call “virtual Wi-Fi” and host-based VPN.
Show this thread
-
-
bootsvc.dll - used for booting up into a layered filesystem disc - part of storage spaces I thinkpic.twitter.com/QtIkfNGyAb
Show this thread -
I think maybe this file enabling altering the bootflow, my recovery wim file grows to 700 from 400 and I think it always boot into the os in there first? This do not seem like a good idea as by default the recovery partition allow unprivileged users to writepic.twitter.com/81iG55uxY9
Show this thread -
This log file I think is about the "setupos" , another os it can boot into to do updatespic.twitter.com/qNUUbTGmAU
Show this thread -
It appears dtrace is loaded by the vail os - and that is not the os that I am in... vail also seems to prepare vm images and launch them....pic.twitter.com/ZEdfaTuj84
Show this thread -
ok - I think that vail is inside the recovery.wim , it is a shielded hidden vm, it seems to be debugging the hypervisor. It is what launches other vms https://pastebin.com/raw/xz4Ah57j
Show this thread
End of conversation
New conversation -
-
-
So reading all your thread, I am still not able to determine if you have been Root-kitted or if this is a legitimate behaviour of the OS u are using?
-
its all legit - i just didnt know about the feature, i think its being tested in insider now, or its an oem thing? i just needed to figure out what was happening, so i could know it was not a bootkit....
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.